General obligations relating to management of risk